From: Dongsu Han <dongsuh@cs.cmu.edu>
Date: Thu, 2 May 2013 09:22:37 +0000 (+0000)
Subject: log: fix history buffer overflow
X-Git-Tag: spdx-start~11406
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=94bc87febf5a6640fb8e96c5d49084f1cebb42ef;p=dpdk.git

log: fix history buffer overflow

The '\0' is written outside the bounds of the log buffer, which can
result in memory corruption or display issues with log messages.

Use a new constant LOG_BUF_SIZE to store the effective size of the
buffer in struct log_history.

Signed-off-by: Dongsu Han <dongsuh@cs.cmu.edu>
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
---

diff --git a/lib/librte_eal/common/eal_common_log.c b/lib/librte_eal/common/eal_common_log.c
index 53fa8bb471..b93311e4eb 100644
--- a/lib/librte_eal/common/eal_common_log.c
+++ b/lib/librte_eal/common/eal_common_log.c
@@ -63,6 +63,7 @@
 #include "eal_private.h"
 
 #define LOG_ELT_SIZE     2048
+#define LOG_BUF_SIZE     (LOG_ELT_SIZE - sizeof(struct log_history))
 
 #define LOG_HISTORY_MP_NAME "log_history"
 
@@ -195,7 +196,7 @@ rte_log_add_in_history(const char *buf, size_t size)
 	}
 
 	/* not enough room for msg, buffer go back in mempool */
-	if (size >= (LOG_ELT_SIZE - sizeof(*hist_buf))) {
+	if (size >= LOG_BUF_SIZE - 1) {
 		rte_mempool_mp_put(log_history_mp, hist_buf);
 		rte_spinlock_unlock(&log_list_lock);
 		return -ENOBUFS;
@@ -203,7 +204,7 @@ rte_log_add_in_history(const char *buf, size_t size)
 
 	/* add in history */
 	memcpy(hist_buf->buf, buf, size);
-	hist_buf->buf[LOG_ELT_SIZE-1] = '\0';
+	hist_buf->buf[size] = '\0';
 	hist_buf->size = size;
 	STAILQ_INSERT_TAIL(&log_history, hist_buf, next);
 	rte_spinlock_unlock(&log_list_lock);